Guide · Data protection

Is an AI phone assistant GDPR compliant, and legal at all?

An AI phone assistant that answers the phone for your business isn't illegal. It can be run GDPR compliant when three things are in place: a data processing agreement with the provider, data storage in the EU, and a transparent notice that an AI is answering. Only unsolicited AI telemarketing is a problem.

By Flo Knies — AI Automation Manager (TÜV SÜD Akademie), three IHK qualifications, trained HVAC and plumbing tradesman and field service technician.

Published June 25, 2026 · Last updated August 30, 2026

Are AI phone calls illegal? The honest answer

The short answer: it depends on who's calling whom. When an AI phone assistant answers incoming calls for your business, meaning customers who are calling you anyway, that's generally allowed. You're simply using a modern tool to stay reachable instead of letting callers land on voicemail. If you want to clarify what this solution even is first, our AI phone assistant page explains the definition and how it works.

It gets tricky in the other direction: outbound marketing calls to private individuals without their explicit consent are heavily restricted in Germany, regardless of whether a human or an AI is calling. So if you're considering an AI answering service that picks up for you, you're on solid ground. If you want to cold-call using AI, you're not. This page covers the first case.

What GDPR compliance actually means on the phone

GDPR compliance isn't a label a product comes with on its own. It results from how the provider and the business work together. Four points matter most in practice:

Data processing agreement (DPA): If the provider processes caller data on your behalf, you need a DPA under Article 28 GDPR. It states what happens to the data, who the subprocessors are, and where processing takes place.
Data storage in the EU: Look for servers in Germany or the EU. That saves you the extra hurdles of a third-country data transfer.
Data minimization: Only what you actually need is captured: who called, what it was about, how urgent it is. A full audio recording usually isn't necessary at all.
Privacy policy: Using the assistant belongs transparently in your privacy policy and in your records of processing activities.

Checklist: a GDPR-compliant AI phone assistant in 5 points

You can recognize a GDPR-compliant AI phone assistant by five checkable points: a data processing agreement under Article 28 GDPR, a server location in Germany or the EU, documented technical and organizational measures (TOMs), call recording only with consent (Section 201 of the German Criminal Code), and a transparent AI notice under Article 50 of the EU AI Act. Work through the list with every provider before you book:

Ask for a data processing agreement (DPA). If the provider processes caller data on your behalf, you need a DPA under Article 28 GDPR. It states what happens to the data, who the subprocessors are, and where processing takes place. If a provider doesn't offer a DPA, the review ends there.
Confirm the server location: Germany or the EU. Ask specifically where voice data, transcripts and summaries are processed and stored, including subprocessors, for example for speech recognition or telephony. EU processing saves you the extra hurdles of a third-country transfer.
Have the TOMs shown to you. The technical and organizational measures under Article 32 GDPR, such as encryption, access control and retention periods, belong as an attachment to the DPA. A serious provider discloses them instead of just writing "GDPR compliant" on their website.
Recording only with consent. Section 201 of the German Criminal Code makes it a criminal offense to record a private conversation without authorization, so a call recording needs the consent of everyone involved, usually through a notice and confirmation at the start of the call. Check whether the assistant stores audio at all or only keeps a structured summary; the data-minimal option is the simpler path.
Does it meet the AI transparency duty? Since August 2, 2026, Article 50 of the EU AI Act requires that callers learn when an AI is speaking. Call the provider's demo or test number and listen to the first sentence: does the assistant introduce itself as an AI? Details are in EU AI Act and AI phone assistants.

You settle points 1 through 3 in writing with the provider; points 4 and 5 you check yourself on the phone. The recording section further below shows how to additionally verify that the answers match practice, and keep in mind: this checklist is a starting point, not legal advice.

Transparent AI notice: what the EU AI Act expects

The EU AI Act requires, among other things, that people be able to recognize when they're talking with an AI system. For your phone assistant, that simply means: it introduces itself as an AI at the start of the call, for example "Hello, this is the digital assistant for company XY." That's not tedious fine print, it builds trust. Callers tend to respond more calmly when they know what they're dealing with from the start, instead of feeling deceived.

Since August 2, 2026, this transparency duty (Article 50 of the AI Act) has been binding; the Digital Omnibus did not push it back. What exactly applies, which deadlines the Omnibus changed, and how a business implements the duty is covered in the companion article EU AI Act and AI Phone Assistants: What's Applied Since August 2, 2026.

For more on how such an assistant behaves in conversation and where the line to voicemail runs, see AI answering service. And for the topic from the caller's perspective, when an AI call is legitimate and when it's a scam, see AI phone calls: allowed, recognizable, explained.

Recording and consent: only as much as necessary

Many people automatically associate "AI on the phone" with a recording. That doesn't have to be the case. Often a structured summary of the request is enough, without storing the call as audio, which is data-minimal and the legally simpler route. If a call is recorded, that needs a legal basis and, as a rule, a clear notice right at the start of the call. When in doubt: better to collect less data than too much.

Data storage in Germany and the EU

For businesses in the DACH region, server location is a central point. When caller data is processed within the EU, ideally in German or European data centers, you stay within a familiar legal framework. Ask the provider specifically about location and the subprocessors involved, and have it confirmed in the DPA. We check exactly this together during setup when you use our AI phone assistant.

Note: this is not legal advice

This article explains the topic in general, accessible terms and does not replace legal advice. Data protection always depends on the specific case, on your industry, your processes, and exactly what data arises. For a binding assessment, consult a data protection officer or a specialized attorney. We support you with the technical implementation and provide the building blocks you need for it. For professionals bound by confidentiality, such as tax practices under Section 203 of the German Criminal Code, the article Will AI Replace Tax Advisors? covers confidentiality on the phone.

Frequently asked questions

AI phone assistant & GDPR, briefly answered.

Are AI phone calls illegal?

No, an AI phone assistant that answers incoming calls for your business isn't illegal by itself. What matters is how it's done: personal data must be processed in line with GDPR, callers should be told transparently that they're speaking with an AI, and any recording needs a legal basis. It gets legally tricky mainly with unsolicited AI telemarketing (cold calls), which is heavily restricted in Germany with or without AI.

Is an AI answering service GDPR compliant?

It can be, if the basics are right: a data processing agreement (DPA) with the provider, data processing within the EU or Germany, a clear mention in your privacy policy, and a clean approach to what's said on the call. GDPR compliance isn't a checkbox a product ticks on its own; it also depends on how you use the assistant.

How do I recognize a GDPR-compliant AI phone assistant?

By five checkable points: the provider offers a data processing agreement under Article 28 GDPR, processes data on servers in Germany or the EU, discloses its technical and organizational measures (TOMs), only records calls with consent (Section 201 of the German Criminal Code), and has the assistant identify itself as AI, as Article 50 of the EU AI Act has required since August 2, 2026. The full checklist with questions to ask is above on this page.

Do I have to tell callers that an AI is answering?

Yes. Since August 2, 2026, Article 50 of the EU AI Act requires that people be informed when they're interacting with an AI system. In practice, that means the assistant introduces itself at the start as your business's AI phone assistant. This builds trust and avoids the impression that someone is being deceived.

Are the calls recorded, and is that allowed?

A full recording of the call isn't strictly necessary; many setups work with a summary instead of an audio recording. If a call is recorded, that needs a legal basis and the consent of the people involved. Section 201 of the German Criminal Code makes it a criminal offense to record a private conversation without authorization. A clear notice with consent at the start of the call is standard practice. When in doubt, the data-minimal option, capturing only what's necessary, is the simpler and cleaner path.

Where is the data stored?

For the DACH region, look for processing within the EU, ideally in German or European data centers. That avoids the extra hurdles that come with a data transfer to third countries. Ask the provider specifically about server location and subprocessors; that belongs in the data processing agreement.

What documentation does my business need?

Standard practice includes a data processing agreement (DPA) with the provider, an entry in your records of processing activities, and a matching section in your privacy policy. This list is a starting point, not exhaustive legal advice; for your specific case, a quick check with a data protection officer or specialized attorney helps.

Can firms with a duty of confidentiality use an AI phone assistant?

Professionals bound by confidentiality, such as attorneys and tax advisors, face additional confidentiality duties on top of GDPR. In practice, that means especially data-minimal capture, a clean data processing agreement, and no substantive case assessment by the AI; it only captures requests and callback wishes. The professional classification for the individual case belongs with a data protection officer or the relevant chamber; this is explicitly not legal advice.

More questions? Find all the answers in our FAQ →